Being hacked feels overwhelming, but recovery follows a clear order: get to a safe device, take back your email, then everything else. Acting calmly in the first hour usually limits the damage to a few changed passwords.
About 12 minutes to readKeep it bookmarkedBeginner
The order matters
Safe device → email → money → everything else. Your email can reset almost every other account, so whoever controls it can undo all your other fixes. If you sent money or gave card details, call your bank first, then come back to this order.
1Recognise the signs
Any one of these is worth acting on:
You can't sign in, or get an email that your password, recovery email or phone number was changed.
Sign-in alerts from places or devices you don't recognise, or two-step prompts you didn't start.
Friends receive messages, posts or emails from you that you didn't send.
Emails you expect go missing, or replies appear in your Sent folder that you didn't write.
Purchases, payments or password reset emails you didn't make or request.
On a computer or phone: new programs, apps or browser extensions you didn't install, a changed homepage or search engine, pop-ups, a security warning from your antivirus, or files that suddenly won't open.
2Get to a safe device
If a computer or phone may be infected, anything you type on it, including new passwords, could be captured.
Do this
If you think a device is infected, disconnect it from Wi-Fi and the network. Leave it switched on if it's a work device, so IT can examine it.
Make the account changes below from a device you trust: another computer, a family member's phone, or your phone if the problem is on your computer.
If it's a work account or work device, tell your IT team now. They can lock things down faster than you can, and may need to protect colleagues.
3Take back your email first
If you can still sign in, change the password straight away. If you can't, use the provider's official recovery page, typed in yourself or reached from the provider's own sign-in page:
Gmail and Google:accounts.google.com/signin/recovery
Outlook, Hotmail and Microsoft:account.live.com/acsr
iCloud and Apple:iforgot.apple.com
Yahoo and others: use “Forgot password” or “Trouble signing in” on the official sign-in page.
Never use a recovery service that contacts you
Companies that find you on social media or by phone offering to recover your account, especially for a fee, are scammers. Use only the provider's own pages.
Once you're back in
Set a new, strong password you've never used anywhere else.
Sign out of all other sessions and devices (look under Security or Devices).
Check and fix your recovery email and phone number. Attackers often change them to keep a way back in.
Look for forwarding rules, filters and auto-replies you didn't create. Attackers set these up to quietly copy or hide your mail, and they keep working after a password change.
Remove connected apps and anyone with delegated access to your mailbox that you don't recognise.
Turn on two-step verification, ideally with a passkey or authenticator app, and save new backup codes (Module 1).
Check the Sent and Deleted folders to see what was sent in your name.
4Secure your other accounts
Banking and payment apps next. Change passwords, check recent transactions and payees, and call the bank about anything unusual.
Any account that used the same password as the hacked one. Attackers try it everywhere.
Your Apple, Google or Microsoft account, which may hold your backups, photos and passwords.
Social media. Use the platform's official help: Facebook at facebook.com/hacked, Instagram at instagram.com/hacked, and the help centre for others. Review recent posts and messages sent from your account.
Your password manager, if you use one: change its master password and check its sign-in history.
For each one: new unique password, sign out of other sessions, check recovery details, turn on two-step verification. Then tell your contacts, from a safe account, to ignore any messages or payment requests that seemed to come from you.
5Clean an infected device
Windows
Run a full and an offline scanOpen Windows Security → Virus & threat protection → Scan options. Run a Full scan, then a Microsoft Defender Offline scan, which restarts the computer to catch hidden malware.
Mac
Update and remove what you don't recogniseInstall all updates, which include Apple's built-in malware protection, and remove apps, login items (System Settings → General → Login Items) and browser extensions you didn't install.
iPhone
Check for management profilesSettings → General → VPN & Device Management. Remove any profile you didn't knowingly install (work phones may have a genuine one), delete unfamiliar apps, and update iOS.
Android
Run Play Protect and check admin appsPlay Store → your profile → Play Protect → Scan. Remove unfamiliar apps, and check Settings → Security for device admin apps you didn't approve.
On every device
Remove browser extensions you don't recognise, and reset the browser's settings if your homepage or search engine changed (Module 6).
Uninstall any remote-access program you were asked to install by a caller.
If in doubt, reset it. Back up your files (not programs), reset the device to factory settings, reinstall apps from official stores, then restore your files. It is the only way to be completely sure.
If files were locked by ransomware, follow the steps in Module 3 and don't pay.
6Protect your money and identity
Call your bank and card providers, using the numbers on your cards, about any payment you didn't make. Ask about stopping or recalling recent transfers.
Consider a credit freeze at Equifax, Experian and TransUnion if personal details such as your Social Security number, date of birth or ID documents were in the hacked account. It's free.
If your identity has been misused, the FTC's IdentityTheft.gov builds a personal recovery plan and the letters you need.
Report crimes to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. A report reference also helps with banks and insurers.
Expect follow-up scams: calls or messages offering to “recover” your account or money are almost always fraud.
7Afterwards: close the door it came through
Once things are calm, work out how it happened so it doesn't happen again. The usual causes, and the modules that fix them:
A reused or leaked password: use a password manager and check your addresses at Have I Been Pwned (Module 1).
No two-step verification, or text-message codes only: switch to passkeys or an authenticator app (Module 1).
A fake message or call: learn the verification habit (Module 4).
A moved phone number: lock your number with your carrier (Module 2).
An out-of-date device or a bad download: automatic updates and official sources only (Module 3, Module 6).
Be kind to yourself
Attackers are professionals, and they catch careful, intelligent people every day. What matters is that you acted. Telling others what happened may also stop it happening to them.
Check your understanding
Your email has been hacked and you've just got back in. Which account do you secure first?
The email itself. Until it's fully secured, the attacker can use it to reset every other account you fix.
You've changed your email password. Why check for forwarding rules?
They keep working. A hidden forwarding rule or filter quietly leaks or hides your mail until you remove it.
A company messages you on social media offering to recover your hacked account for a fee. What is it?
A scam. Real providers don't contact you to sell recovery. Go to their official help pages yourself.
Your recovery checklist
Your ticks are saved only in this browser. Nothing is sent anywhere.
This module is general educational information, not professional or legal advice, and following it cannot guarantee full recovery of accounts, data or money. Recovery steps and menu names change; use each provider's current official help pages. If a business or work systems are affected, involve your IT team or a professional incident response provider. Products are named as examples only; Rondel Group is not affiliated with them.